Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
17/12/2022, 16:53
Static task
static1
Behavioral task
behavioral1
Sample
GeometryDash.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
GeometryDash.exe
Resource
win10v2004-20220812-en
General
-
Target
GeometryDash.exe
-
Size
6.5MB
-
MD5
47b4e0d8ab93a33cd20f902a387ac7e7
-
SHA1
89187e3a148e8ca063d0e0b008f3c7cd6a0a4729
-
SHA256
5db66b8f102b6914e752c404aebb2fe6af5a31ded5494a6a844c22077a8c75e0
-
SHA512
9fe8c85d3097162389a22cc0c204ca84c7c864fa4dbfc52988883dc2456f8474ceb81e95350a32d90520654bcb0c3596044ba5fae6d9a7eacdb9a38e61d0a547
-
SSDEEP
49152:Bug8dPHi2XXq8dWlHIuKO77iX+4LVoVNG+w6xfS+w6xfSExfSRaTQAYjzDTjE:QDnq8W9KO7epGVNVVxfS+VxfSgfSR
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 3588 chrome.exe 3588 chrome.exe 4672 chrome.exe 4672 chrome.exe 112 chrome.exe 112 chrome.exe 760 chrome.exe 760 chrome.exe 1400 chrome.exe 1400 chrome.exe 1368 chrome.exe 1368 chrome.exe 5032 chrome.exe 5032 chrome.exe 5108 chrome.exe 5108 chrome.exe 4372 chrome.exe 4372 chrome.exe 4372 chrome.exe 4372 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 112 chrome.exe 112 chrome.exe 112 chrome.exe 112 chrome.exe -
Suspicious use of FindShellTrayWindow 52 IoCs
pid Process 112 chrome.exe 112 chrome.exe 112 chrome.exe 112 chrome.exe 112 chrome.exe 112 chrome.exe 112 chrome.exe 112 chrome.exe 112 chrome.exe 112 chrome.exe 112 chrome.exe 112 chrome.exe 112 chrome.exe 112 chrome.exe 112 chrome.exe 112 chrome.exe 112 chrome.exe 112 chrome.exe 112 chrome.exe 112 chrome.exe 112 chrome.exe 112 chrome.exe 112 chrome.exe 112 chrome.exe 112 chrome.exe 112 chrome.exe 112 chrome.exe 112 chrome.exe 112 chrome.exe 112 chrome.exe 112 chrome.exe 112 chrome.exe 112 chrome.exe 112 chrome.exe 112 chrome.exe 112 chrome.exe 112 chrome.exe 112 chrome.exe 112 chrome.exe 112 chrome.exe 112 chrome.exe 112 chrome.exe 112 chrome.exe 112 chrome.exe 112 chrome.exe 112 chrome.exe 112 chrome.exe 112 chrome.exe 112 chrome.exe 112 chrome.exe 112 chrome.exe 112 chrome.exe -
Suspicious use of SendNotifyMessage 48 IoCs
pid Process 112 chrome.exe 112 chrome.exe 112 chrome.exe 112 chrome.exe 112 chrome.exe 112 chrome.exe 112 chrome.exe 112 chrome.exe 112 chrome.exe 112 chrome.exe 112 chrome.exe 112 chrome.exe 112 chrome.exe 112 chrome.exe 112 chrome.exe 112 chrome.exe 112 chrome.exe 112 chrome.exe 112 chrome.exe 112 chrome.exe 112 chrome.exe 112 chrome.exe 112 chrome.exe 112 chrome.exe 112 chrome.exe 112 chrome.exe 112 chrome.exe 112 chrome.exe 112 chrome.exe 112 chrome.exe 112 chrome.exe 112 chrome.exe 112 chrome.exe 112 chrome.exe 112 chrome.exe 112 chrome.exe 112 chrome.exe 112 chrome.exe 112 chrome.exe 112 chrome.exe 112 chrome.exe 112 chrome.exe 112 chrome.exe 112 chrome.exe 112 chrome.exe 112 chrome.exe 112 chrome.exe 112 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2020 wrote to memory of 2916 2020 chrome.exe 86 PID 2020 wrote to memory of 2916 2020 chrome.exe 86 PID 112 wrote to memory of 316 112 chrome.exe 88 PID 112 wrote to memory of 316 112 chrome.exe 88 PID 112 wrote to memory of 4348 112 chrome.exe 91 PID 112 wrote to memory of 4348 112 chrome.exe 91 PID 112 wrote to memory of 4348 112 chrome.exe 91 PID 112 wrote to memory of 4348 112 chrome.exe 91 PID 112 wrote to memory of 4348 112 chrome.exe 91 PID 112 wrote to memory of 4348 112 chrome.exe 91 PID 112 wrote to memory of 4348 112 chrome.exe 91 PID 112 wrote to memory of 4348 112 chrome.exe 91 PID 112 wrote to memory of 4348 112 chrome.exe 91 PID 112 wrote to memory of 4348 112 chrome.exe 91 PID 112 wrote to memory of 4348 112 chrome.exe 91 PID 112 wrote to memory of 4348 112 chrome.exe 91 PID 112 wrote to memory of 4348 112 chrome.exe 91 PID 112 wrote to memory of 4348 112 chrome.exe 91 PID 112 wrote to memory of 4348 112 chrome.exe 91 PID 112 wrote to memory of 4348 112 chrome.exe 91 PID 112 wrote to memory of 4348 112 chrome.exe 91 PID 112 wrote to memory of 4348 112 chrome.exe 91 PID 112 wrote to memory of 4348 112 chrome.exe 91 PID 112 wrote to memory of 4348 112 chrome.exe 91 PID 112 wrote to memory of 4348 112 chrome.exe 91 PID 112 wrote to memory of 4348 112 chrome.exe 91 PID 112 wrote to memory of 4348 112 chrome.exe 91 PID 112 wrote to memory of 4348 112 chrome.exe 91 PID 112 wrote to memory of 4348 112 chrome.exe 91 PID 112 wrote to memory of 4348 112 chrome.exe 91 PID 112 wrote to memory of 4348 112 chrome.exe 91 PID 112 wrote to memory of 4348 112 chrome.exe 91 PID 112 wrote to memory of 4348 112 chrome.exe 91 PID 112 wrote to memory of 4348 112 chrome.exe 91 PID 112 wrote to memory of 4348 112 chrome.exe 91 PID 112 wrote to memory of 4348 112 chrome.exe 91 PID 112 wrote to memory of 4348 112 chrome.exe 91 PID 112 wrote to memory of 4348 112 chrome.exe 91 PID 112 wrote to memory of 4348 112 chrome.exe 91 PID 112 wrote to memory of 4348 112 chrome.exe 91 PID 112 wrote to memory of 4348 112 chrome.exe 91 PID 112 wrote to memory of 4348 112 chrome.exe 91 PID 112 wrote to memory of 4348 112 chrome.exe 91 PID 112 wrote to memory of 4348 112 chrome.exe 91 PID 2020 wrote to memory of 3412 2020 chrome.exe 92 PID 2020 wrote to memory of 3412 2020 chrome.exe 92 PID 2020 wrote to memory of 3412 2020 chrome.exe 92 PID 2020 wrote to memory of 3412 2020 chrome.exe 92 PID 2020 wrote to memory of 3412 2020 chrome.exe 92 PID 2020 wrote to memory of 3412 2020 chrome.exe 92 PID 2020 wrote to memory of 3412 2020 chrome.exe 92 PID 2020 wrote to memory of 3412 2020 chrome.exe 92 PID 2020 wrote to memory of 3412 2020 chrome.exe 92 PID 2020 wrote to memory of 3412 2020 chrome.exe 92 PID 2020 wrote to memory of 3412 2020 chrome.exe 92 PID 2020 wrote to memory of 3412 2020 chrome.exe 92 PID 2020 wrote to memory of 3412 2020 chrome.exe 92 PID 2020 wrote to memory of 3412 2020 chrome.exe 92 PID 2020 wrote to memory of 3412 2020 chrome.exe 92 PID 2020 wrote to memory of 3412 2020 chrome.exe 92 PID 2020 wrote to memory of 3412 2020 chrome.exe 92 PID 2020 wrote to memory of 3412 2020 chrome.exe 92 PID 2020 wrote to memory of 3412 2020 chrome.exe 92 PID 2020 wrote to memory of 3412 2020 chrome.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\GeometryDash.exe"C:\Users\Admin\AppData\Local\Temp\GeometryDash.exe"1⤵PID:5008
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff830ad4f50,0x7ff830ad4f60,0x7ff830ad4f702⤵PID:2916
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1260,15938098429903797911,15324166912288618547,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1616 /prefetch:22⤵PID:3412
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1260,15938098429903797911,15324166912288618547,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1952 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3588
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:112 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff830ad4f50,0x7ff830ad4f60,0x7ff830ad4f702⤵PID:316
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1636,4246510593089135763,111003174107848796,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1644 /prefetch:22⤵PID:4348
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1636,4246510593089135763,111003174107848796,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2004 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4672
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1636,4246510593089135763,111003174107848796,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2292 /prefetch:82⤵PID:1404
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,4246510593089135763,111003174107848796,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2976 /prefetch:12⤵PID:2252
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,4246510593089135763,111003174107848796,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3116 /prefetch:12⤵PID:1592
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,4246510593089135763,111003174107848796,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3752 /prefetch:12⤵PID:652
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,4246510593089135763,111003174107848796,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4432 /prefetch:82⤵PID:4184
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1636,4246510593089135763,111003174107848796,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5208 /prefetch:82⤵PID:4836
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,4246510593089135763,111003174107848796,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5276 /prefetch:82⤵PID:3720
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,4246510593089135763,111003174107848796,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5308 /prefetch:82⤵PID:4428
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,4246510593089135763,111003174107848796,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5348 /prefetch:82⤵PID:4648
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,4246510593089135763,111003174107848796,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5248 /prefetch:82⤵PID:1048
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1636,4246510593089135763,111003174107848796,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5588 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:760
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,4246510593089135763,111003174107848796,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5612 /prefetch:82⤵PID:3884
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1636,4246510593089135763,111003174107848796,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5748 /prefetch:82⤵PID:4660
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,4246510593089135763,111003174107848796,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5476 /prefetch:82⤵PID:328
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,4246510593089135763,111003174107848796,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5836 /prefetch:12⤵PID:2960
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1636,4246510593089135763,111003174107848796,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4960 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1400
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1636,4246510593089135763,111003174107848796,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4688 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1368
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1636,4246510593089135763,111003174107848796,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=852 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:5032
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,4246510593089135763,111003174107848796,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1528 /prefetch:82⤵PID:4340
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1636,4246510593089135763,111003174107848796,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5648 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:5108
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1636,4246510593089135763,111003174107848796,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2008 /prefetch:82⤵PID:1156
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1636,4246510593089135763,111003174107848796,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2036 /prefetch:82⤵PID:1424
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1636,4246510593089135763,111003174107848796,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5760 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4372
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1636,4246510593089135763,111003174107848796,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1400 /prefetch:82⤵PID:3276
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3076
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
40B
MD560cd6e50a74c45f9514c2ec70fe16a0d
SHA14d09cb4351688681c28912f89869703fc3a98c0a
SHA25632fc80412bdafb44620e9694a7a9e1328c6067977021068d93061ee7753522d1
SHA512cbab6f727cfedfeddd32fb9763479530530b79df262d09f319fecac9f89d9e08a5f38331f85f26930a35bf6e5bac01821b8edea4bd2b3abec5db55ff4468857e
-
Filesize
40B
MD560cd6e50a74c45f9514c2ec70fe16a0d
SHA14d09cb4351688681c28912f89869703fc3a98c0a
SHA25632fc80412bdafb44620e9694a7a9e1328c6067977021068d93061ee7753522d1
SHA512cbab6f727cfedfeddd32fb9763479530530b79df262d09f319fecac9f89d9e08a5f38331f85f26930a35bf6e5bac01821b8edea4bd2b3abec5db55ff4468857e
-
Filesize
40B
MD560cd6e50a74c45f9514c2ec70fe16a0d
SHA14d09cb4351688681c28912f89869703fc3a98c0a
SHA25632fc80412bdafb44620e9694a7a9e1328c6067977021068d93061ee7753522d1
SHA512cbab6f727cfedfeddd32fb9763479530530b79df262d09f319fecac9f89d9e08a5f38331f85f26930a35bf6e5bac01821b8edea4bd2b3abec5db55ff4468857e
-
Filesize
88KB
MD551d3dfbfd13d385c325f60a8e5756419
SHA1ffdcfe7d92d244559a7bd153f29edb23c12d000e
SHA2563d472badca940da7c7b1bfcf5093a5a68ff31a423da4ada11bbf8e864470412f
SHA512939e2b6f55c32bb1f6f4b467b3aa225ae6d32bb95b6b970624da5e1606ddd80f5709c51a55014d32ee46a6215057be7d79d1c974fc6f6c524c5a9b376f4ec6bb